52

When I change my password on Stack Overflow through my settings, it only requires me to type my new password and repeat my new password, whereas most other websites would require me to type my old password as well. It doesn't email me a confirmation code either, the only other way that I could think of confirming that the user really does indeed want to run the action.

Isn't this a possible CSRF vulnerability? For example, I write a website that maliciously includes the reset URL as an image or submits a password reset as part of a form?

I'm not complaining though; it was useful considering I had forgot my password, but was still logged in.

17
  • 5
    What openID provider are you using?
    – Servy
    Commented Jul 13, 2016 at 20:51
  • 12
    Just to clarify, this is the user profile page you can access only while you are logged in? There's some random tokeny junk appended that a CSRF attacker would not be able to replicate. And since you're already logged in...
    – ryanyuyu
    Commented Jul 13, 2016 at 20:52
  • 1
    The request that updates your password is almost certainly required to be a POST request.
    – user229044 Mod
    Commented Jul 13, 2016 at 21:03
  • 12
    Probably not a CSRF vulnerability, but it may be a fairly large target for a hypothetical script injection.
    – Undo Mod
    Commented Jul 13, 2016 at 21:10
  • 3
    @Undo - In other words, a stack snippet could accomplish this.
    – Travis J
    Commented Jul 13, 2016 at 21:41
  • 1
    @Travis Snippets are quite well insulated against this, so probably not (unless there's a bug that in iframes that allows arbitrary JS through, which would surprise me)
    – Undo Mod
    Commented Jul 13, 2016 at 21:43
  • 1
    @meagar Forms and Ajax requests usually can get around the problem of POST requests being required. However, as ryanyuyu points out, there is a token, which I hadn't noticed. Tokens are considered the best way to solve CSRF...
    – Laef
    Commented Jul 13, 2016 at 22:33
  • 17
    Would still be nice to get an email notification IMO.
    – Siguza
    Commented Jul 14, 2016 at 0:00
  • 19
  • 2
    @TJ - Yes. A user script will have that access because it is part of the environment. I mean, to be brutally transparent, the fkey is in an element on the page.
    – Travis J
    Commented Jul 14, 2016 at 8:38
  • 4
    @ryanyuyu Being logged in has nothing to do with it; whilst having to enter your old password does annoy me, having to enter it is obviously a better security practice. What happens if someone accesses a computer where someone else is logged into SO and then changes the users password? That user would now be locked out of their account..... whereas if it required the old password the malicious user wouldn't be able to do this. Yes the locked out user could just reset their password if this happens but what if they also change the users email address?
    – Brett
    Commented Jul 15, 2016 at 10:05
  • 2
    @Brett Of course following this logic, we should require password reentry whenever the user is doing anything more than voting. But I do agree that passwords, at least, should be secured with the old one (and there's password reset if you've forgotten the old one).
    – Laef
    Commented Jul 15, 2016 at 20:12
  • 1
    @laef Yes I see what you're saying, but you have to draw the line somewhere and it's a lot worse having your account taken over completely than just for one session/situation.
    – Brett
    Commented Jul 16, 2016 at 6:55
  • 3
    CSRF set aside, it looks like a severe security breach. What if you leave your computer for 2 minutes, forget to lock it, and someone changes your password meanwhile?
    – Jivan
    Commented Jul 16, 2016 at 17:04
  • 2
    @Jivan I was thinking the same thing. Forget about script injection; this is mostly to protect users who step away from their computers from having their account stolen (think public terminals). Usually, other critical fields such as username, email address, etc. should also be protected behind an additional password prompt. Commented Jul 16, 2016 at 21:37

1 Answer 1

12

This was indeed a security risk, especially for people using shared computers. The change password page has been modified so that it nows asks the current password in addition to the new password.

Update:

We have found a few issues after deploy and will need to tweak a couple of things. So for now this new feature is temporarily disabled. Sorry for the inconveniences.

Update 2:

Feature enabled again. Sorry for the inconveniences.

1
  • 2
    If the feature is deployed and enabled now, can you mark this as status-completed?
    – Magisch
    Commented Aug 19, 2016 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .